msm: camera: sync: Prevent OOB access of sync name
Issue: strlcpy calls strlen on src ptr. If src is not NULL terminated then OOB access will occur in below stack. strlen strlcpy cam_sync_init_row cam_sync_handle_create cam_sync_dev_ioctl Fix: Pad user-space supplied name with NULL. CRs-Fixed: 3010262 Change-Id: Ib5c2fbfe395025ec05e0bb2980f86111e95ff54c Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
This commit is contained in:
1 parent
b1ac875feb
commit
85689be983
1 file changed
+2
-1
@@ -1,6 +1,6 @@
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
/*
|
||||
* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
|
||||
* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <linux/init.h>
|
||||
@@ -471,6 +471,7 @@ static int cam_sync_handle_create(struct cam_private_ioctl_arg *k_ioctl)
|
||||
u64_to_user_ptr(k_ioctl->ioctl_ptr),
|
||||
k_ioctl->size))
|
||||
return -EFAULT;
|
||||
sync_create.name[SYNC_DEBUG_NAME_LEN] = '\0';
|
||||
|
||||
result = cam_sync_create(&sync_create.sync_obj,
|
||||
sync_create.name);
|
||||
|
||||
Reference in new issue
Block a user